CVE-2026-21140: Medium severity Samsung ManagedProvisioning vulnerability
Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ManagedProvisioningto a version that resolves this vulnerability.Patch SMR Sep-2026 Release 1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access to an affected Samsung device. The CVSS vector indicates no privileges or user interaction are required.
What is the impact of successful exploitation?
A local attacker can install arbitrary applications on the device. The available impact information identifies confidentiality impact as high, with no stated integrity or availability impact.
Which releases address the issue?
Samsung ManagedProvisioning releases before SMR Sep-2026 Release 1 are affected. Updating to SMR Sep-2026 Release 1 or later addresses the affected version range described.